CVE-2026-2298

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-88

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 23, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-229807.8In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can racCVE-2026-229815.5In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a reset Protect the reseCVE-2026-229825.5In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Commit CVE-2026-229835.5In the Linux kernel, the following vulnerability has been resolved: net: do not write to msg_get_inq in callee NULL pointer dereference fiCVE-2026-229847.1In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() PCVE-2026-229855.5In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RCVE-2026-229864.7In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were callingCVE-2026-229875.5In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy CVE-2026-229885.5In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_creCVE-2026-229895.5In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are tryiCVE-2026-22994.3The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authentCVE-2026-229905.5In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If t
CVE-2026-2298: Critical severity, CVSS 9.4 | Vulnix